I don't know about legal responsibility, but this happened because the driver was working for Uber. Uber knew who the carjacker was before it happened, and they directed the driver to the carjacking.
This wouldn't have happened without Uber's involvement, and Uber is uniquely situated to be able to prevent this type of carjacking. If they're not responsible for the costs of their safety decisions, they should be.
They have more of an opportunity to prevent carjackings than the drivers do. For example, they could require enough information to create an account that if you stole a car using your account you'd be immediately identified and reported to the police by name.
The downside of this is that it decreases Uber's revenue. If Uber realizes the benefits of low security in their app, but not the costs, they have to incentive to take these or any other precautions. Making Uber responsible for the negative externalities of its service means that they have to take them into account when determining how to maximize profit.
This wouldn't have happened without Uber's involvement, and Uber is uniquely situated to be able to prevent this type of carjacking. If they're not responsible for the costs of their safety decisions, they should be.